dynamic roles on a Java EE server

Question

I want to manage user and roles in a dedicated application. For example a user of this application ("customerX boss") can create a new role "customerX employee". If an employee accesses the Java EE application server (GlassFish 3) he should get the role "customerX employee".

It sounds simple, but it is not supported by Java EE, because groups are mapped to roles at start-up time and the roles within the application are static.

What is the best way to manage user roles at runtime in a Java EE (6) environment?

Sevenfold

I've created java.net/jira/browse/JAVAEE_SPEC-20 in support of (among others) this use case. If you or anyone else is still bothered by the lack of dynamism in Java EE roles, please vote for it or leave a comment. – Fusion

Answer 1

The declarative security in Java EE is indeed no suited for such requirements. The problem of security can be split in two:

• authentication
• authorization

I had similar requirement once. We used the built-in authentication to have the principal set and relied then on the default Java EE login mechanisms. But we ended up managing the authorization part manually at the applicative-level.

Indeed, even the roles that will be loaded and associated with the principal (isUserInRole for the web and isCallerInRole for the EJB) need to be specified in web.xml or ejb.xml which doesn't provide enough flexibility. We had then to load the roles manually (according to the principal) from LDAP or ActiveDirectory. We then used EJB3 interceptors and Servlet filter to perform the security checks ourselves.

I would however strongly suggest to stick to a Role-based access control (RBAC) and not implement something more fancy. There are several frameworks that can help to deal with home-made RBAC.

We also had a look at JSecurity and Acegi Security and they seemed interesting.

Bronson

Thanks for your answer, especially for the hint that even dynamically set roles have to be declared statically in web.xml or ejb.xml! That would have been the next pitfall for me. I will check out JSecurity an Spring Security (the successor of Acegi) static.springsource.org/spring-security/site/index.html. – Sevenfold

JSecurity is now called "Shiro". cwiki.apache.org/confluence/display/SHIRO/Index – Sevenfold

Yes, roles declared with <security-role> or @DeclaredRoles are actually symbolic names that should be mapped to the role in the external directory (e.g. LDAP) using <security-role-mapping>. If the mapping is 1-to-1, Glassfish has an option "default principal to role mapping", but that's only half of the solution and you must still list the role somewhere. – Bronson

There is also no way to actually list all roles a user has with the JEE API. You will need to iterate over the fixed list of role and use isCallerInRole or isUserInRole. There are some way to downcast the Principal and then get the list of roles, but it's not portable I think (I don't remember exactly for this one). – Bronson

Actually, Ron Monzillo's blog offers a portable solution to getting a Principal's roles. – Dominance

Another note: at least JBoss AS doesn't enforce the requirement that all roles should be listed upfront. If a login module puts a dynamic list of roles into a Subject, then you can test for those using e.g. is[Caller/User]InRole and it will return true without those roles having been declared anywhere. – Fusion